virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avformat/rpl: Use 64bit for total_audio_size and check it

Browse Source 
Fixes: 62276/clusterfuzz-testcase-minimized-ffmpeg_dem_RPL_fuzzer-4677434693517312
Fixes: signed integer overflow: 5555555555555555556 * 8 cannot be represented in type 'long long'

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 878625812f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-03-26 00:36:40 +01:00
parent 0ba64f1042
commit a5e39d0a27
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/rpl.c
View File

@ -117,7 +117,7 @@ static int rpl_read_header(AVFormatContext *s)
AVIOContext *pb = s->pb;
RPLContext *rpl = s->priv_data;
AVStream *vst = NULL, *ast = NULL;
int total_audio_size;
int64_t total_audio_size;
int error = 0;
const char *endptr;
char audio_type[RPL_LINE_LENGTH];
@ -299,6 +299,8 @@ static int rpl_read_header(AVFormatContext *s)
if (ast)
av_add_index_entry(ast, offset + video_size, total_audio_size,
audio_size, audio_size * 8, 0);
if (total_audio_size/8 + (uint64_t)audio_size >= INT64_MAX/8)
return AVERROR_INVALIDDATA;
total_audio_size += audio_size * 8;
}